Security Policy

How to report

Email details to hello@myaqualog.com with reproduction steps, impact, and any proof of concept. Please include "Security" in the subject line.

Scope and expectations

• Do not access data that is not your own.
• Do not perform denial-of-service or destructive testing.
• Do not publicly disclose findings until we confirm a fix is deployed.
• Test only against your own accounts and data.

Safe harbor

We consider security research conducted in accordance with this policy to be authorized and will not pursue legal action against researchers who:

• Act in good faith and avoid privacy violations, data destruction, and service disruption.
• Only access their own accounts and test data.
• Report vulnerabilities promptly and give us reasonable time to remediate before disclosure.
• Do not exploit vulnerabilities beyond what is necessary to demonstrate the issue.

Response window

We aim to acknowledge reports within 3 business days and follow up with status updates during investigation and remediation. Critical vulnerabilities are prioritized for immediate response.

Security measures

MyAquaLog implements the following security controls:

• Encryption in transit: All connections use HTTPS with TLS 1.3.
• Encryption at rest: Database encrypted via Supabase infrastructure.
• Authentication: Secure session handling via Supabase Auth with OAuth 2.0 support.
• Authorization: Row-Level Security (RLS) policies enforce data isolation per user.
• Rate limiting: API endpoints protected against brute force and abuse.
• Input validation: Server-side validation on all user inputs.
• CSRF protection: SameSite cookies and origin validation.
• Bot protection: Cloudflare Turnstile on sensitive forms.
• Error handling: Sensitive data scrubbed from error logs (Sentry).
• Dependency scanning: Automated security updates via Dependabot.

Out of scope

• Social engineering attacks (phishing, vishing, etc.)
• Physical security issues
• Attacks requiring access to a user's device or credentials
• Third-party services we do not control (Supabase, Stripe, Vercel, etc.)
• Spam or issues with email deliverability
• Missing security headers that do not lead to exploitable vulnerabilities